From 697fc001c3e47b59e97da7627e27ff8ad1a4167a Mon Sep 17 00:00:00 2001 From: Tom Eastep Date: Sun, 25 Nov 2012 16:31:05 -0800 Subject: [PATCH] Return to zone-based handling of 'all'. Signed-off-by: Tom Eastep --- Shorewall/Perl/Shorewall/Raw.pm | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/Shorewall/Perl/Shorewall/Raw.pm b/Shorewall/Perl/Shorewall/Raw.pm index f5cb69bff..67fcfeac5 100644 --- a/Shorewall/Perl/Shorewall/Raw.pm +++ b/Shorewall/Perl/Shorewall/Raw.pm @@ -255,8 +255,18 @@ sub setup_conntrack() { if ( $format < 3 ) { if ( $source =~ /^all(-)?(:(.+))?$/ ) { fatal_error 'USER/GROUP is not allowed unless the SOURCE zone is $FW or a Vserver zone' if $user ne '-'; - process_conntrack_rule( $raw_table->{OUTPUT}, undef, $action, $3 || '-', $dest, $proto, $ports, $sports, $user , $switch ) unless $1; - process_conntrack_rule( $raw_table->{PREROUTING}, undef, $action, $3 || '-', $dest, $proto, $ports, $sports, $user , $switch ); + for my $zone ( $1 ? off_firewall_zones : all_zones ) { + process_conntrack_rule( undef , + undef, + $action, + $zone . ( $2 || ''), + $dest, + $proto, + $ports, + $sports, + $user , + $switch ); + } } else { process_conntrack_rule( undef, undef, $action, $source, $dest, $proto, $ports, $sports, $user, $switch ); }